Re: [PATCH] rapidio: fix rio_dma_transfer error handling

[Alexandre Bounine]

On 2018-04-12 05:28 PM, Andrew Morton wrote:
> On Thu, 12 Apr 2018 17:06:05 +0200 Ioan Nicu <ioan.nicu.ext@xxxxxxxxx> wrote:
>
> > Some of the mport_dma_req structure members were initialized late
> > inside the do_dma_request() function, just before submitting the
> > request to the dma engine. But we have some error branches before
> > that. In case of such an error, the code would return on the error
> > path and trigger the calling of dma_req_free() with a req structure
> > which is not completely initialized. This causes a NULL pointer
> > dereference in dma_req_free().
> >
> > This patch fixes these error branches by making sure that all
> > necessary mport_dma_req structure members are initialized in
> > rio_dma_transfer() immediately after the request structure gets
> > allocated.
>
> This sounds like something which someone has actually triggered in a
> real-world situation.  So I added a cc:stable.  Please let me know if
> that was inappropriate.
>
> And please remember to always include all information regarding
> end-user impact when fixing bugs.
This bug fix is applicable to versions starting from v4.6